Microsegmentation rollouts: what keeps the enforcement tail so long?

TL;DR: Multi-site microsegmentation often takes one to three years to reach full enforcement even though individual sites can come online in minutes to hours, according to Elisity. The real constraint is organisational readiness, change control, and policy sequencing, not the underlying software, which makes rollout governance the decisive security variable.

NHIMG editorial — based on content published by Elisity: What a Multi-Site Microsegmentation Rollout Actually Looks Like (and Why Most Take Years)

By the numbers:

• Only 9% have protected more than 80% of critical systems, even though 99% are implementing or planning microsegmentation.
• St. Luke's University Health Network segmented 15 hospitals, 350 practices, and 85,000 devices in 46 days.
• A global manufacturing program brought software to nearly all of roughly 29 sites within six months, while full enforcement ran from month four to month 15.

Questions worth separating out

Q: How should security teams implement microsegmentation across multiple sites?

A: Start with a template site, run learning mode first, and move to enforcement in small waves.

Q: Why do multi-site microsegmentation projects take so long?

A: They take long because change control, asset discovery, and policy sign-off are slower than deployment.

Q: What breaks when microsegmentation is not in place after initial access?

A: Without microsegmentation, one compromised foothold can become an internal launch point for discovery, credential abuse, and lateral movement.

Practitioner guidance

• Report enforced coverage, not activation counts Track how much of the estate is actually enforcing policy, how much remains in simulation, and how many exceptions are still open.
• Build one reusable template site Use a familiar location as the reference pattern, validate flows with the site owners, then clone the policy model across later waves.
• Treat identity dependencies as rollout prerequisites Verify directory health, service-account permissions, and connector reliability before scheduling enforcement windows.

What's in the full article

Elisity's full article covers the operational detail this post intentionally leaves for the source:

• Per-site rollout sequencing, including how teams choose a template site and move from learning mode to enforcement.
• Day-by-day rollout phases for the first 30, 60, and 90 days, including validation and change-window timing.
• Examples of how large estates handled change control, exceptions, and parallel wave execution.
• Case-study details on organisations that reached scale quickly without forcing a rip-and-replace network redesign.

👉 Read Elisity's analysis of multi-site microsegmentation rollout timing and enforcement →

Microsegmentation rollouts: what keeps the enforcement tail so long?

Explore further

View Full Forum →  |  NHI Foundation Course →